A now-patched ChatGPT Lockdown Mode bypass let attackers quietly copy a user's full chat history and, in some paths, deliver phishing forms or malware along the way. Check Point Research published the findings on November 5, 2026, and security outlets have been picking up the story since. Lockdown Mode is the optional setting OpenAI offers for people handling sensitive material, so the gap hits the users who expected the most protection.
The researchers did not need a victim to make a risky choice. Depending on the setup, a malicious prompt, a booby-trapped custom GPT or a shared chat could send conversation data to an attacker's server. OpenAI has since fixed the bypass, and Check Point said it saw no real attacks. The details still matter, because the flaw shows how a safety control can miss a feature that sits right beside it.
How the ChatGPT Lockdown Mode bypass worked
The weakness lived in ChatGPT's HTML preview feature. According to Cryptika, OpenAI added an HTML preview to ChatGPT code blocks in February 2026. Check Point found a loophole in how popup windows were handled inside those previews, and that loophole let an attacker escape the sandbox meant to contain the content.
The Hacker News quoted the mechanism from Check Point's findings: “By creating another nested frame within the rendered page, it was possible to access an unmodified popup function.” Put simply, the attacker nested a frame inside the preview to reach a popup function that had never been changed to handle that case. Check Point's own write-up stated the problem more directly: “We found a vulnerability in ChatGPT that allowed an attacker to bypass Lockdown Mode.”
Once the sandbox was breached, the attacker could reach chat data. GBHackers reported that a malicious prompt, a malicious custom GPT or a shared chat could each silently send chat messages to an attacker's server with no interaction. Cryptika added that the whole conversation and any uploaded files could be sent out. SecurityOnline also reported that the attack could deliver fake popups and credential-phishing forms.
The exposure differed by setting, as the reporting describes it:
| Setting | What the reporting describes |
|---|---|
| Browser, shared chat link | No account needed. Downloads are not blocked in a browser, so opening a shared chat link was enough. |
| ChatGPT Classic desktop app | Normal use was enough. Simply having a conversation triggered the leak. |
| Malicious prompt, custom GPT or shared chat | Could silently send chat messages to an attacker's server with no user interaction. |
Why Lockdown Mode did not stop the attack
Lockdown Mode is designed to protect sensitive user data from prompt injection attacks that try to extract information. Prompt injection hides instructions in web pages, files or shared chats to get an assistant to leak data. When the setting is on, it restricts browsing to cached content, blocks web images, and turns off Canvas networking, Deep Research, Agent Mode, live connectors and file downloads, according to GBHackers.
The Hacker News reported that OpenAI introduced Lockdown Mode in June 2026. Check Point's write-up describes the feature only as recently introduced, so the timeline is not fully settled. Either way, the setting was built to stop this class of attack, and a bypass cuts against a feature sold for sensitive work.
A Greek analysis from TheLab.gr makes the central point: Lockdown Mode correctly restricted the tools it controls but did not cover the separate HTML preview function. That is the pattern to watch. A safety switch protects the features its designers listed, and attackers look for the one nobody listed.
Who is exposed and what remains unclear
Three groups carry the most risk. The first is US ChatGPT users who paste client records, financial details, medical notes or company material into chats. The second is anyone who opens shared chat links or runs third-party custom GPTs. The third is enterprises that relied on Lockdown Mode to meet compliance obligations.
Reporting points to the desktop app as the clearest exposure. Whether the web and mobile versions were affected is still unclear in the sources reviewed. Users weighing AI for money tasks face a related tradeoff. USA 24 recently looked at Claude Personal Finance, which can read bank data but cannot move money, and the real question there is what an assistant can see.
What to do now: steps for ChatGPT users
The reporting supports a short list of practical steps:
- Keep the ChatGPT desktop app updated, as the reporting advises.
- Keep medical, financial and work secrets out of chats unless the task truly requires them.
- Treat shared chat links and third-party custom GPTs with caution, since clicking content in a shared chat could be dangerous, according to Check Point's guidance.
- Do not treat Lockdown Mode as a full guarantee for sensitive data. This bypass defeated it.
- If your team relies on Lockdown Mode for compliance, document the bypass and decide whether the setting still meets your requirements until a formal review is done.
When OpenAI fixed the flaw and what is disputed
The fix date is not settled. SecurityOnline reports that OpenAI resolved the loophole in September 2026, and TheLab.gr gives September 18. The Hacker News calls the flaw now-patched without giving a date, so the exact day should be confirmed with OpenAI.
The remedy itself is specific. According to a TLDR summary, OpenAI removed the problematic popup permissions from the outer sandbox iframe. Wilson's Media reports that, after Check Point disclosed its findings, OpenAI added safeguards to disable the Lockdown Mode workaround.
Several gaps remain. No CVE identifier or formal OpenAI advisory appeared in the sources reviewed, and USA 24 found no on-the-record OpenAI spokesperson statement in that material. ProductNation reports that Check Point saw no real attacks, but that claim comes from a secondary source rather than Check Point's own write-up.
Why this lands during the AI rules fight
The timing matters. Senators Cantwell and Rounds urged the White House to coordinate a federal response to AI-enabled cyber threats, and Democrats plan to introduce bills that would require independent testing of advanced AI systems, according to Claims Journal. States are moving faster than Washington. According to the National Conference of State Legislatures, US states introduced 1,539 AI bills in 2026, up from 1,262 the previous year.
This is also not Check Point's first ChatGPT finding this year. In March, the team showed that DNS tunneling in ChatGPT's code runtime could send chat data to an outside server, according to Cryptika. Two disclosures in one year point to a moving attack surface, not a single bug. Defaults and settings are part of the trust problem too. USA 24 reported that an OpenAI Codex training setting was reportedly turned back on without notice, which is a reminder that a control users rely on can change under them.
What to watch next
Three things will show whether this flaw was a contained fix or a sign of a wider pattern. The first is OpenAI's written account of the fix, including the exact date and whether it assigns a CVE. The second is whether Lockdown Mode gets coverage for HTML previews and popup handling, the exact gap that Greek analysis identified. The third is whether the web and mobile versions were affected, which the reporting has not settled.
On the policy side, watch how the proposed bills on independent testing of advanced AI systems move once Democrats take control of Congress. A flaw like this one gives those proposals a concrete example. Security teams should expect more findings of this kind, and they should plan for a setting that protects data less completely than its label suggests.
